Commit4df30e7

m-v-b

authored and

gregkh

committed

usbcore/driver: Fix incorrect downcast

This commit resolves a minor bug in the selection/discovery of morespecific USB device drivers for devices that are currently bound togeneric USB device drivers.The bug is related to the way a candidate USB device driver iscompared against the generic USB device driver. The code inis_dev_usb_generic_driver() assumes that the device driver in questionis a USB device driver by calling to_usb_device_driver(dev->driver)to downcast; however I have observed that this assumption is not alwaystrue, through code instrumentation.This commit avoids the incorrect downcast altogether by comparingthe USB device's driver (i.e., dev->driver) to the generic USBdevice driver directly. This method was suggested by Alan Stern.This bug was found while investigating Andrey Konovalov's reportindicating usbip device driver misbehaviour with the recently mergedgeneric USB device driver selection feature. The report is linkedbelow.Fixes:d5643d2 ("USB: Fix device driver race")Cc: <stable@vger.kernel.org> # 5.8Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>Cc: Alan Stern <stern@rowland.harvard.edu>Cc: Bastien Nocera <hadess@hadess.net>Cc: Shuah Khan <shuah@kernel.org>Cc: Valentina Manea <valentina.manea.m@gmail.com>Cc: <syzkaller@googlegroups.com>Tested-by: Andrey Konovalov <andreyknvl@google.com>Signed-off-by: M. Vefa Bicakci <m.v.b@runbox.com>Link:https://lore.kernel.org/r/20200922110703.720960-4-m.v.b@runbox.comSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 parentaea850c commit4df30e7Copy full SHA for 4df30e7

File tree

1 file changed

-9

lines changed

drivers/usb/core
- driver.c

1 file changed

-9

lines changed

`‎drivers/usb/core/driver.c‎`

Lines changed: 2 additions & 9 deletions

Original file line number	Diff line number	Diff line change
`@@ -905,21 +905,14 @@ static int usb_uevent(struct device dev, struct kobj_uevent_env env)`
`905`	`905`	`return0;`
`906`	`906`	`}`
`907`	`907`
`908`		`-staticboolis_dev_usb_generic_driver(structdevice*dev)`
`909`		`-{`
`910`		`-structusb_device_driver*udd=dev->driver ?`
`911`		`-to_usb_device_driver(dev->driver) :NULL;`
`912`		`-`
`913`		`-returnudd==&usb_generic_driver;`
`914`		`-}`
`915`		`-`
`916`	`908`	`staticint__usb_bus_reprobe_drivers(structdevicedev,voiddata)`
`917`	`909`	`{`
`918`	`910`	`structusb_device_driver*new_udriver=data;`
`919`	`911`	`structusb_device*udev;`
`920`	`912`	`intret;`
`921`	`913`
`922`		`-if (!is_dev_usb_generic_driver(dev))`
	`914`	`+/* Don't reprobe if current driver isn't usb_generic_driver */`
	`915`	`+if (dev->driver!=&usb_generic_driver.drvwrap.driver)`
`923`	`916`	`return0;`
`924`	`917`
`925`	`918`	`udev=to_usb_device(dev);`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit4df30e7

File tree

1 file changed

1 file changed

`‎drivers/usb/core/driver.c‎`

0 commit comments